7 HTTP session management

In the previous chapter, you learned about TLS. In this chapter, you’ll build on top of that knowledge, literally. You’ll learn how HTTP sessions are implemented with cookies. You’ll also learn how to configure HTTP sessions in Django. Along the way, I’ll show you how to safely implement session-state persistence. Finally, you’ll learn how to identify and resist remote code-execution attacks and replay attacks.

7.1 What are HTTP sessions?

HTTP sessions are a necessity for all but the most trivial web applications. Web applications use HTTP sessions to isolate the traffic, context, and state of each user. This is the basis for every form of online transaction. If you’re buying something on Amazon, messaging someone on Facebook, or transferring money from your bank, the server must be able to identify you across multiple requests.

7.2 HTTP cookies

7.2.1 Secure directive

7.2.2 Domain directive

7.2.3 Max-Age directive

7.2.4 Browser-length sessions

7.2.5 Setting cookies programmatically

7.3 Session-state persistence

7.3.1 The session serializer

7.3.2 Simple cache-based sessions

7.3.3 Write-through cache-based sessions

7.3.4 Database-based session engine